NeighborGeek

Mystery Solved: Bitlocker is enabled, but Intune shows the computer as non-compliant for Require Bitlocker

2019-02-25T09:45:00.001-06:00

For some time, I have struggled to understand why Intune reports some computers as non-compliant with the "Require Bitlocker" setting, even though Bitlocker is enabled and working on the computer. In my searches for an explanation, I found the same question asked by many others, but never an answer. Until today.

I accidentally stumbled across this article from Microsoft's Rob Lane, which explains how the Require Bitlocker setting is evaluated and why it might seem to incorrectly report a non-compliant state. I encourage you to check out that article for full details. I'll just summarize here the part that suddenly made this bitlocker compliance issue make sense to me.

The "Require Bitlocker" setting in Intune relies on the Device Health Attestation (DHA) service in Windows 10 to report the state of Bitlocker encryption on the computer.
If Bitlocker protection is disabled or suspended, DHA will report that the computer is non-compliant with this setting.
The DHA service only checks the Bitlocker state at boot time. This means that if the state changes after the computer boots, DHA will continue to report the old state until the next time the computer restarts.

This means that if Bitlocker protection is suspended when a computer restarts, even if protection is automatically resumed after the restart, Intune will report the computer as not compliant with the Require Bitlocker setting until the next time the computer is restarted.

Here's why this could be a very common situation in environments managed by SCCM. As we all know, Windows Updates often require restarting the computer to complete installation. If Bitlocker is enabled & has an active PIN protector, the computer will prompt for the Bitlocker PIN as part of the restart. Until a user sees the prompt & enters the PIN, the computer can't boot back up, much less finish applying updates.

To get around this issue, when an update requires a restart SCCM will suspend bitlocker protection on the drive before restarting the computer. This allows the computer to restart, finish applying updates, and return to the Windows login screen automatically, with no user intervention required. Once the updates are applied and Windows fully loaded, SCCM automatically resumes bitlocker protection.

During that restart, the DHA service will check whether the drive is being protected by bitlocker. Since protection is suspended, it records the drive as not protected. Protection is resumed once Windows boots, but the DHA service doesn't know that. It will report the computer as non-compliant until it checks again when the computer next restarts.

Putting it all together, this means that after Windows Updates are deployed using SCCM, it is to be expected that computers appear in intune as non-compliant with the Require Bitlocker setting. Updating that compliance status will require restarting the computer again, without suspending bitlocker. This could be done by the users or automatically from remote. Just be aware that if you restart the computers remotely, they won't boot back up until a user is present at the keyboard and enters the Bitlocker PIN to grant access to the drive.

Skype for Business Online adds support for Common Area Phones (At Last!)

2018-03-02T11:55:00.001-06:00

The long awaited option for licensing common area phones for use with Skype for Business Online/Office 365 Phone System has arrived.

Since the announcement of the Office 365 Phone System (Then called Cloud PBX) at Ignite 2015, IT Pros have struggled with how to configure and license common area phones for this offering. While the on premises version of Lync/Skype for Business server has long supported these common area phones, the cloud version has not. Until now, adding a phone which was not associated with a specific user required treating the phone's Office 365 account as an additional user, assigning it a combination of Office 365 licenses that made little sense for a stand alone phone in a break room or other other shared area. This was cost prohibitive in many cases, and prevented some companies from making the move to Microsoft's otherwise attractive cloud based phone system.

In January, Microsoft's Alejandro Araujo Rajzner revealed in a Microsoft Tech Community post that a new SKU was coming to enable licensing of common area phones for use with Skype for Business Online. That new SKU, named simply "Common Area Phone" is now available for purchase through the Office 365 portal. As with all licenses for Office 365 phone system, this $8/month Common Area Phone license will also require a separately licensed calling plan in order to make or receive calls to outside numbers (AKA POTS, or Plain Old Telephone Service). The domestic US calling plan costs $12/mo and includes up to 3000 minutes of calls. This puts the total cost for a common area phone with POTS connectivity at just $20/month, compared to as high as $47/month under the old licensing requirements.

The new license will also require a skype for business certified phone which has been updated to support the new Common Area Phone plan. Tom Arbuthnot wrote a great article last month about recent firmware updates from Audicodes and Polycom which added support for provisioning common area phones. I highly recommend you check it out, as he also included detailed covereage and step by step screenshots of the provisioning process.

Since this new license for Common Area Phones has only just been made available for purchase, there is limited documentation available. I was able to piece this much together from various sources, but I expect that we'll start seeing more details directly from Microsoft in the coming days and weeks.

Automate cleanup of CB Defense sensor after a failed uninstall using SCCM

2018-02-21T13:55:00.000-06:00

CarbonBlack recently released version 3.1 of the 'sensor' for their CB Defense product. This sensor is the client side agent installed on each PC. The CB Defense sensor does not self update, but installing the new version should be as simple as a few clicks in the CB Defense web console or downloading the install package and deploying it using your favorite method. Unfortunately, it's not always so simple.

In many cases, when the installer attempts to remove the old version of the sensor during the upgrade process, the uninstall does not completely remove the old sensor, and installation of the new sensor fails. This leaves the computer with no working version of the CB Defense sensor installed. The old version of the sensor no longer shows up under "Programs and Features", and all attempts to install the new version fail.

The CarbonBlack User Exchange (login required) site has a few articles describing this issue and potential workarounds. An article CB Defense: Uninstall the Windows Sensor even includes a link to download the handy Sensor Removal Tool, perfect for just this situation. The sensor removal tool is designed to remove any bits and pieces of the sensor left behind after a failed uninstall. Simply extract the appropriate exe from the zip file and run it with the /cleanup parameter, and it will take care of the rest! Of course, that only fixes the computer you run it on. What if you deployed the new sensor version out to many or all of your clients, and now need to perform this cleanup on hundreds of computers?

This is where System Center Configuration Manger (SCCM) steps in to save the day. Download SensorRemovalTool.zip and extract the contents. Select Sensor21RemovalToolx64.exe (or Sensor21RemovalToolx86.exe if you're still running a 32-bit OS), and copy it to a network share where you store your source files for SCCM apps and packages.

In the Software Library workspace of the SCCM console, select Packages in the left pane, and then click the "Create Package" button on the toolbar.

In the Create Package and Program wizard, enter a name and description for your package. Check the box next to "This package contains source files, and use the Browse button to enter the UNC path to the network share where you saved the sensor removal tool exe file.

On the Program Type screen, accept the default of "Standard Package" and click next. Next you'll fill in details about the Standard program. Enter a name which makes sense to you. In the "Command Line field, enter:

Sensor21RemovalToolx64.exe /Cleanup

Click Next through the remaining screens to accept the defaults and create the package. Once the package is created, you're ready to distribute the content and deploy the package to a collection of computers. Give the deployment time to run, removing the sensor from all computers in the collection, then re-deploy the CB Defense 3.1 sensor install to the collection. All computers in the collection should now be able to install the new sensor successfully.

Error mounting ISO file - "Sorry, there was a problem mounting the file"

2017-10-31T13:30:00.003-05:00

Recently, I've had problems using the built in functionality of Windows Explorer to mount ISO files as a virtual DVD drive. When I tried to mount an iso, there was a long delay with the 'wait' cursor, and eventually I got an error dialog which said simply "Sorry, there was a problem mounting the file." Subsequent attempts to mount an iso file (whether the same file or a different file) would immediately return the error, without delay.

I searched far and wide online and could not find a solution that applied in my environment. Eventually, I tried mounting the iso using the "Mount-DiskImage" powershell command in hopes of getting a more informative error message. The error I got was:

Mount-DiskImage : A virtual disk support provider for the specified file was not found.

Searching for that error message lead me to posts about problems installing a device driver. Then, everything clicked...

Some time ago, we implemented some Device Installation Restriction group policy settings. By default, installation of any new devices on a computer is blocked, unless it is explicitly listed in the policy as an allowed device. Since the Microsoft virtual DVD Rom device wasn't explicitly allowed, it was being blocked by policy. Normally, when a device fails to install because of this policy windows pops up a toast notification with that info, but it does not in this case.

Adding the device "scsi\cdrommsft____virtual_dvd-rom_" to the list of allowed device ID's resolved this issue and allowed me to successfully mount an iso.

The moral of the story, if you're using group policy or any software which restricts the installation of devices, this could be causing the failure mounting iso files. Disable that policy or software temporarily to test, and if that fixes the issue, add the above device ID to your allowed list.

Hope that helps someone else find the issue a little bit faster than I did!

Data Sharing Service crashes on Windows Server 2016 - Event ID 7023

2017-05-05T09:16:00.000-05:00

While troubleshooting an issue recently on a Windows Server 2016 system, I noticed errors on the System event log about the Data Sharing Service crashing.


	The Data Sharing Service service terminated with the following error: %%3239247874

Searching online for more information about this service and why it might be failing, I came across a lot of people describing similar problems, but the only explanation and solution I found came from this December blog post by Microsoft Japan. Google translate did a great job making the post understandable to me, but since the information doesn't seem to have been widely publicized I thought I'd share it here to help get the word out.

The Data Sharing Service fails due to a resource conflict with another service included in Server 2016, the User Access Logging Service. Either one of these services alone will run without issue, but if one is already running and you try to start the other, it will fail.

According to an update to the blog post, Microsoft plans to resolve the issue in a future update to Server 2016, but in the mean time there is a simple workaround that will allow the Data Sharing Service and User Access Logging Service to live in harmony. The internal resource conflict occurs because the two services are running in a shared process. By configuring the services to each run in their own process, the conflict is avoided and both services can be running at the same time. Run these two commands to change the configuration:

Sc config ualsvc type=own

Sc config dssvc type=own

After changing the service configuration, you should now be able to start the Data Sharing Service successfully.

Windows 10 Credential Guard breaks WiFi

2016-08-17T10:43:00.003-05:00

Recently, I ran into an issue with computers running windows 10 that would not connect to our WPA2-Enterprise encrypted wifi network. When it failed to connect, there was no indication of why, only the message "Can't connect to this network." The computers were able to connect to unencrypted networks and networks using a Pre-shared key for WPA encryption without issue.

Checking the event logs on the RADIUS server to see why the comptuer failed to connect, there was no log entry for a connection attempt from the affected system. The WLAN-Auto-Config log on the client listed a couple of errors, including Event ID 11006 and 12013, but other than showing that the failure reason was "Explicit EAP failure received", they didn't give much to go on:

Log Name: Microsoft-Windows-WLAN-AutoConfig/Operational
Source: Microsoft-Windows-WLAN-AutoConfig
Date: 8/15/2016 1:11:20 PM
Event ID: 11006
Task Category: MsmSecurity
Level: Error
Keywords: (1024),(512)
User: SYSTEM
Computer: computer.domain.com
Description:
Wireless security failed.
Network Adapter: Intel(R) Dual Band Wireless-AC 7265
Interface GUID: {32a54564-27eb-479a-82f3-10a9b736f9d8}
Local MAC Address: AA:BB:CC:DD:EE:FF
Network SSID: CHC1
BSS Type: Infrastructure
Peer MAC Address: 00:11:22:33:44:55
Reason: Explicit Eap failure received
Error: 0x80070285

Log Name: Microsoft-Windows-WLAN-AutoConfig/Operational
Source: Microsoft-Windows-WLAN-AutoConfig
Date: 8/15/2016 1:11:20 PM
Event ID: 12013
Task Category: OneXAuthentication
Level: Error
Keywords: (1024),(512)
User: SYSTEM
Computer: computer.domain.com
Description:
Wireless 802.1x authentication failed.
Network Adapter: Intel(R) Dual Band Wireless-AC 7265
Interface GUID: {32a54564-27eb-479a-82f3-10a9b736f9d8}
Local MAC Address: AA:BB:CC:DD:EE:FF
Network SSID: CHC1
BSS Type: Infrastructure
Peer MAC Address: 00:11:22:33:44:55
Identity: host/computer.domain.com
User:
Domain:
Reason: Explicit Eap failure received
Error: 0x80070285
EAP Reason: 0x285
EAP Root cause String: There was an internal authentication error.
EAP Error: 0x285

After spending significant time toubleshooting the issue, I found that the issue was caused by the new "Credential Guard" feature in windows 10. In the technet article documenting this new feature, there is a single line which explains why this was happening:

Credential Guard also does not allow unconstrained Kerberos delegation, NTLMv1, MS-CHAPv2, Digest, CredSSP, and Kerberos DES encryption.

As it turns out, our radius server and the GPO which pushed our wireless settings out to clients were configured to use MS PEAP for authentication. At first glance, that doesn't seem to conflict with the statement above, but the P in PEAP stands for protected. It basically creates an encrypted tunnel first, over which standard EAP authentication takes place. The EAP communication travelling through that encrypted connection can be configured to use either "Secured Password (EAP-MSCHAP v2)" or "Smart Card or other Certificate". You can guess which mine was using.

For a Credential Guard enabled computer to authenticate to a WPA2-Enterprise wireless network, the network must use certificate based authentication. In my case, we already had the PKI in place, so it was a simple matter of configuring the RADIUS server to accept certificate based authentication and changing the Wireless Settings in our GPO to use a certificate for authentication instead of the Secured Password option. After making these changes and connecting these clients to ethernet to get a group policy update, they were able to successfully authenticate with and connect to the WPA2-Enterprise encrypted network. If you don't already have a Public Key Infrastructure (PKI) set up, this will require installing configuring the Certificate Authority role on a Windows server, and issuing certificates to users and/or computers. (Ideally, configuring computers to auto enroll with the CA for computer certificates.)

When I was searching online for what could possibly cause my issue, searching for the error message and event details I had turned up nothing useful. Any posts I found from others with similar errors turned out to be unrelated. In the end, I did find a single page by Nigel Kemp documenting his experience with this issue, but only after I had already identified the likely culprit and searched specifically for "Credential Guard breaks Wifi". Still, I was thankful to have the confirmation that I was on the right track. I hope that by including the specific errors and events in this blog post, it will help others find the solution to this problem a little easier.

Configuring Bitlocker and TPM on Server 2012R2 Core

2016-04-29T15:16:00.002-05:00

I've just finished configuring Bitlocker on a new server running Server Core 2012R2 with a TPM key protector. I had to piece together bits from a few sources online to accomplish this, so I will bring together in this one post all of the steps I ended up using.

Here's a high level overview of the steps required:

Check TPM status
Enable & activate TPM if needed
Take ownership of TPM
Create Bitlocker recovery password
Backup recovery password to Active Directory
Enable Bitlocker using the TPM as the key protector

In order to do this, the server must have a TPM module installed. Believe it or not, this is still not standard hardware for many servers. For HP servers, a TPM add-on is available for about $50 as p/n 488069-B21. If you do have to install a TPM, go into the BIOS and enable the TPM under the security settings, to save yourself some steps later.

Now comes the tricky part. Powershell version 4 added some handy new cmdlets for managing the TPM. Unfortunately, for some reason those cmdlets are not included in Server Core installs, so we have to resort to using WMI. The Scripting Guy has a great blog post that gets into all of the details on this, written by guest blogger Stephane van Gulick, which my process was based on.

First, use WMI to get the Win32_TPM class, which contains all of the methods required for managing the TPM. By assigning it to a variable $TPM, we can use the variable to call the methods we need.

$Tpm = Get-CIMClass -Namespace ROOT\CIMV2\Security\MicrosoftTpm -Class Win32_Tpm

EDIT 05/26/2017 : It may be necessary to use "Get-WMIObject" instead of Get-CIMClass in the above command.

Next, run the following commands to check the current status of the TPM.

$Tpm.IsEnabled().isenabled
$Tpm.IsActivated().isactivated
$Tpm.IsOwned().isOwned

Each of those commands will return a boolean true or false. If the TPM isn't enabled, enable it using:

$Tpm.Enable()

Once the TPM is enabled and activated, it's time to take ownership. If the TPM is already owned, it will need to be cleared first. Then, prepare a TPM owner password to be used, and take ownership.

$tpm.Clear()
$password = 'P@ssword'
$tpmpassword = $tpm.ConvertToOwnerAuth($password).OwnerAuth
$tpm.TakeOwnership($tpmpassword)

Now the Trusted Platform Module is enabled, active, owned, and ready to store the Bitlocker key protector. But before we can start encrypting the drive, the Bitlocker feature must be installed using 'install-windowsfeature'

Install-WindowsFeature Bitlocker

At this point, I tried to enable bitlocker using a TPM protector, but because our group policy settings require that a bitlocker recovery password be backed up to Active Directory, the command failed.

According to the documentation for Enable-Bitlocker, the there are several parameters which can be used to specify what type of key protector should be used. While some of these parameters include multiple protectors, The TPMProtector and RecoveryPasswordProtector options are mutually exclusive, and cannot be combined. Lucky for me, the documentation also includes this handy tip to point me in the right direction:

It is common practice to add a recovery password to an operating system volume by using the Add-BitLockerKeyProtector cmdlet, and then save the recovery password by using the Backup-BitLockerKeyProtector cmdlet, and then enable BitLocker for the drive. This procedure ensures that you have a recovery option.

Use the Add-BitlockerKeyProtector cmdlet to create the recovery password. Then find the protector ID and use it to back up the recovery password to Active Directory using Backup-BitlockerKeyProtector. (It may not be necessary to run Backup-BitlockerKeyProtector if group policy requires the password be backed up when created, but it won't hurt anything to back it up again just to be safe.)

add-bitlockerkeyprotector -mountpoint c: -recoverypasswordprotector
$BLV = Get-BitLockerVolume -MountPoint "C:"
Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[1].KeyProtectorId

I ran Enable-Bitlocker again, but once again hit a snag:

Because my group policy also requires that OS drives encrypted with Bitlocker use a TPM protector, it appears that a TPM protector was assigned automatically when I added the Recovery Password protector. Since the drive was already set up with a TPM protector, the enable command failed when it tried to add another. The Enable-Bitlocker command requires the use of one of the protector parameters though, so even though the required protectors were already present, I couldn't simply enable bitlocker using the existing protectors. To work around that, I ran it again using the RecoveryPasswordProtector option.

Enable-BitLocker -recoverypasswordprotector -mountpoint c: -encryptionmethod AES256

Finally, bitlocker was successfully enabled. Powershell helpfully provided the recovery password again and instructed me to save it in a safe place, and instructed me to restart the computer for a hardware test before encryption begins. The restart can be avoided if necessary by using the -skiphardwaretest parameter, but I wouldn't recommend it.

One unfortunate result of my mis-steps along the way is that I ended up with 3 separate Recovery Password Protectors assigned to the drive, and all 3 backed up to AD. I will need to do further testing to determine why the additional passwords were created, but I suspect it may have happened as a result of my failed attempts with the "enable-bitlocker" command. If you know why this happened, or if you have any questions, please leave a comment below.

Thanks for reading!

Viewing Windows Update logs in Windows 10

2016-04-29T11:20:00.000-05:00

For many years, dating back at least to Windows XP, Windows Update has kept a text format log in the Windows directory, which could provide useful information when troubleshooting update issues. Beginning in Windows 10, this log file (C:\Windows\WindowsUpdate.log) Is no longer used. If you look for it in the Windows directory, you'll see that the file is still there, but is only 275 bytes, compared to the 1-2MB log files of the past. The contents of this file now explain that it isn't used anymore, and list a powershell command to get a readable windows update log:

As you can see, there is a simple solution in the form of a new powershell cmdlet. Simply run "get-windowsupdatelog" in powershell, and wait. You'll see various input and output files scroll by in the powershell window as it parses the new "ETW" (Event Tracing for Windows" formatted logs, located in "c:\windows\logs\windowsupdate\". When the cmdlet finishes, it will create a new windowsupdate.log file on the desktop:

Note that get-windowsupdatelog uses publicly available symbols to decode the ETL files and create the text formatted log. The first time you run the command, you may have to accept terms to access Microsoft's internet based symbol store.

If you're running a preview build, this commnand may not be able to decode the output, as the symbols for most preview builds aren't made available publicly. In that case, you'll still get a windowsupdate.log file on your desktop, but the information in it will be less than helpful:

For more information on reading the windows update logs in Windows 10, check out KB3036646.

Now Available: Remote Server Administration Tools for Windows 10

2015-08-19T12:27:00.002-05:00

Throughout the latter portion of the Windows Insider program testing of Windows 10, and continuing on since the release of Windows 10 last month, one question has been very popular: Where is the Remote Server Administration Tools package for Windows 10?

Finally, the wait is over:
Download the Remote Server Administration Tools for Windows 10

No KMS Key in the VLSC for Windows 10 for OPEN License

2015-08-17T16:59:00.004-05:00

With the release of Windows 10, many IT workers are beginning to look into it and perhaps test it for use in their organizations. When the time comes to set up KMS activation of the new OS however, those IT staff using Microsoft's OPEN Licensing may find that something is missing...

When I logged in to the Volume License Service Center recently to look up the KMS activation key for Windows 10 Enterprise, I was surprised to find that only Multiple Activation Keys (MAK) were listed. Searching online, I came across this blog post from someone who ended up calling Volume Licensing support to get his KMS key, but with no explaination as to why. After digging around a bit, I happened to come across an entry in the VLSC FAQ which explains the missing key.

If you can't read that, it says:

I am an Open Customer and do not see my KMS (Key Management Service) key displayed on VLSC. How can I get it?
KMS keys are no longer pre-assigned to Open agreements as use of MAK (Multiple Activation Key) keys is the preferred method for activation.
If you are an Open Customer and need a KMS key, please request one by either calling the PA Call Center or emailing KMSADD with your business need.

For whatever reason, Microsoft is no longer generating KMS keys automatically for customers using Open licensing. MAK keys are now considered "the preferred method for activation" and will be the only keys listed in VLSC for OPEN customers by default. OPEN customers can still receive a KMS key, but must call or email the VL support center to have a key generated.

If you are an OPEN license customer in need of a KMS key, just send an email to kmsadd@microsoft.com to request the a key and they should be able to generate one and add it to your account.

Convert Windows 10 Pro ISO to Enterprise

2015-07-06T12:46:00.000-05:00

For recent builds of the Windows 10 Technical Preview, when Microsoft has released ISO images of a build they have elected not to release ISO's of Enterprise Edition. The most recent Enterprise edition ISO available is for build 10074. While it is possible to download and install that build, then upgrade to the more recent builds using windows update, having install media for the current version would make things much easier.

The good news is, all of the bits for Enterprise edition are included in the ISO of Windows 10 Pro Technical Preview, and with a few simple commands it's possible to change from Pro to Enterprise edition.

To get started, download the latest Windows 10 Pro Technical Preview ISO. As of the time of this writing, the image currently available is build 10162. Extract the contents of the iso into a temporary directory. In my example, I use D:\10162\.

From a command prompt, Create an empty directory to mount the wim file in, and mount the image:

Check the current edition and available targets that the mounted image can be upgraded to:

As shown in the output above, my image is currently Professional edition, and can be upgraded to either Enterprise or Education editions. I'll upgrade to Enterprise using the /set-edition parameter of dism, then run dism again with the /get-currentedition parameter to confirm the change was successful:

Since the Enterprise edition requires a different product key than the Professional edition, the product key used in the image must also be updated:

Lastly, unmount the wim image, committing the changes that were made:

D:\10162 now contains the install files for Enterprise edition. Run setup from there, or copy the files to bootable media to install a clean version of the latest Windows 10 Enterprise Technical Preview.

For reference, the commands used in the screenshots above are listed in order below:

md d:\mount
dism /mount-wim /wimfile:d:\10162\sources\install.wim /mountdir:D:\mount /index:1
dism /image:d:\mount /get-currentedition
dism /image:d:\mount /get-targeteditions
dism /image:d:\mount /set-edition:Enterprise
dism /image:d:\mount /get-currentedition
dism /image:d:\mount /set-productkey:CKFK9-QNGF2-D34FM-99QX2-8XC4K
dism /unmount-wim /mountdir:d:\mount /commit

I hope this information is helpful. While it was written and tested with Windows 10 Technical preview, it should also work with Windows 8, 8.1, Server 2012 and 2012R2 (with minor changes), and most likely with the RTM version of Windows 10 when it is released. More information about the DISM parameters used can be found on technet.

ISP DNS Hijacking breaks DirectAccess connectivity

2015-06-16T09:50:00.000-05:00

Edit: Thanks to Richard Hicks for commenting on this post. It seems that my understanding of exactly why things broke the way they did may have been flawed. I leave the post here for reference however, since it does describe the symptoms and the solution that worked in this particular situation. Understand however that the explanation of why the solution worked may not be correct. We recently began piloting Microsoft's DirectAccess (DA) for use connecting remote/mobile computers to our internal network over the internet. Yesterday I received a call from a user who had been using DirectAccess for several weeks without issue, but suddenly was not able to access internal resources. I'm documenting the issue here in hopes that it will help others experiencing similar issues with DirectAccess connections.

The first thing I tried was to remote control the computer using SCCM. When this connected successfully, I knew that the DA connection had at least established the tunnel and was working, even if it reported that it wasn't. After a bit of testing to identify what was working and what wasn't, I determined that when the computer tried to connect to the network location server it was able to resolve the host name to an IP address, but couldn't verify the identity of the server at the IP address given.

The network location server is used by DA to determine whether the computer is connected to the internal network, and thus whether DA needs to create a tunnel for corporate connectivity. DA attempts to establish an SSL connection to a web server on a host that can only be accessed internally. If the computer is on the internal network, the connection is successful and DA verifies the remote server's identity based on the SSL certificate. If the computer is connected to the public internet, the internal host name should not be resolved by DNS, and DA will then attempt to establish a secure tunnel to the internal network. An entry in the client's Name Resolution Policy Table (NRPT) prevents the client from connecting to that internal host over an established DA connection.

When the user's computer tried to resolve the internal host name of the NLS, instead of responding with "Non-existent domain" as it should, the ISP's DNS server returned an IP address of 198.105.254.63. The client then tried unsuccessfully to open an SSL connection to the server at that address to verify that it was on the internal network and did not need to establish a DA tunnel. At this point, even though DA was able to successfully open a connection to the internal network, it showed on the client side that corporate connectivity was not working, and the user was not able to connect to some internal resources.

This user was working from home, using an internet connection from their cable company, Mediacom. Like many big ISP's these days, Mediacom uses a form of deep packet inspection to return search results instead of a proper error when the address a user entered doesn't point to a valid web page. They also configure their DNS servers to respond with the IP of their "Search Guide" servers so they can provide search results even when the user enters key words or other data that isn't a valid address at all. By hijacking their users requests in this way, they can provide search results from their service instead of from the user's preferred search engine (or instead of returning a message that the page cannot be found.) They present this as a feature, a service to their users, but of course in reality it is designed to take a cut of money that google and others make selling ads in search results, by redirecting users to Mediacom's search results and ads instead.

To resolve this issue, the user had to get to one of the Mediacom search results pages. From a new browser window, I had the user attempt to browse to a web address that I knew didn't exist. As expected, this returned a Mediacom branded page listing search results similar to the address she entered. At the top right corner of this page was a Settings link, which opened a Preferences dialog with a single option inside labeled Search Guide Settings.

After turning off the Search Guide and saving changes, the user tried again to browse to a non-existant site and received a proper error message. Next, we tried to resolve the name of the internal NLS server and received the "Non-existant domain" response that was expected, instead of the IP of Mediacom's search server. By the time we were done testing these, the Direct Access Connectivity Assistant had already updated to show that corporate connectivity was working. The user's mail client was connected successfully to the server, and the intranet page which initially indicated a problem when it wouldn't display was now loading successfully.

Now the user is fully connected again and enjoying the simplicity of using DA. The only question that remains is why this DNS hijacking didn't affect this user previously, as Mediacom has been known for several years now to hijack DNS requests for non-existant domains and return the address of their search servers instead.

TL;DR: If an ISP hijacks DNS requests for non-existant domains, this can cause problems for DirectAccess connections when attempting to determine the client's network location.

Windows Update doesn't work in Windows 10 Technical Preview build 10041 on a corporate network

2015-03-31T08:48:00.001-05:00

After updating to the recently released build #10041 of the Windows 10 Techincal Preview, I found that Windows Update wasn't working for me. The old style Windows Update was no longer available from the Control Panel. The new Windows Update in the modern "Settings" app showed that I had no updates available, and last checked for updates on 2/2/2015. If I clicked the Check Updates button, nothing seemed to happen, or occasionally the "last checked" date would flicker briefly, but not change.

This PC is a member of a domain, with an active System Center Configuration Manager 2012R2 server. As such, it would normally get it's updates from the SCCM server (which in turn pulls them through the associated WSUS server.) However, SCCM doesn't offer updates for the Technical Preview, so that isn't an option when running a preview build of Windows 10.

I found that to get Windows Update working, I had to change the policy setting which points my workstation to the configmgr server for updates. The easiest way to do this in a one-off situation like this is to edit the local policy.

Open the start menu, and type "gpedit.msc" and press enter. This should launch the Local Group Policy Editor. In the left pane, expand "Computer Configuration\Administrative Templates\Windows Components" and select the "Windows Update" folder. In the right pane, look for any settings with a State other than "Not configured". The important one here is "Specify intranet Microsoft update service location". If this setting is enabled, Windows will check the specified server for updates, instead of Microsoft's internet based update servers. Double click on this setting, and change it to Disabled. (This setting should automatically revert back to the previous setting after a period of time, but you may want to make a note of it before you make the change, just to be safe.)

After disabling this setting, apply the changes and click ok. Wait a moment or two, then open the modern "Settings" app again. Select "Update & Recovery", and click the "Check for Updates" button. The "last checked" info should disappear, and be replaced with a message that it is checking for updates. After a few minutes, some updates should be available. (I believe to date there have been 4 windows updates released for build 10041. In my case, I also had a few driver updates available which had been released in the past week or so.)

This change will also allow the computer to check for new builds of the Windows 10 Technical preview, including the just released build 10049.

How to use import-gvhistory script to parse Google Voice data from Takeout and export it to a .csv file

2014-12-20T17:44:00.001-06:00

I recently posted the import-gvhistory powershell script that I wrote, which parses the html files provided by Google Takeout when downloading data from a Google Voice account. Below are step by step instructions on how to use the script.

Note: The link below to HTML Agility Pack goes to a codeplex page where you can download version 1.46. There is a note at the top of the page that the latest version is available from NuGet. Currently, the version on NuGet is 1.4.9. Either of those versions will work, so for simplicity I recommend you just click the big purple download button and get v1.4.6 if you aren't already familiar with NuGet.

Download your Google Voice data using Google Takeout.
Extract the the zip file to c:\temp or another path of your choosing.
**Windows 7 Users** Download and install WMF4 to update Powershell to 4.0
Download the HTML Agility Pack, unzip the file, open the NET45 folder inside, and copy HtmlAgilityPack.dll the same folder. For example, I'll use c:\temp
Open a new notepad window. Copy the entire text of the script from this post, and save the file as c:\temp\import-gvhistory.ps1
Open Powershell (It's probably in your start menu, under the name Windows Powershell )
Type "cd \temp" (without the quotes)
Type ". .\import-gvhistory.ps1" (without quotes. Note that this begins with a period, a space, then another period, don't leave out that first period!)
Type "import-gvhistory -path c:\temp\takeout\calls | export-csv c:\temp\GVHistory.csv"

That should take just a minute or two before the prompt comes back up. Once you're back at the prompt, there will be a new file c:\temp\GVHistory.csv containing the details of all your google voice calls, texts, etc. Those who are more comfortable working with powershell can leave off the export-csv part of the command and pipe the data to where-object or other tools to filter or otherwise manipulate the data as needed.

import-gvhistory: Export Google Voice SMS/Text Messages and Call logs to CSV using Powershell

2014-12-16T16:32:00.001-06:00

Here is a script I wrote to parse the thousands of HTML files produced by Google Takeout when exporting Google Voice data. This script parses the html files to gather the Contact Name, Number, time, type (Placed/received etc), duration, and (text/voicemail) message contents for every phone call and text message, and outputs them as a powershell object which can be further filtered or manipulated and then exported into a csv or other format as needed.

Basic examples of how to use this script are included in the script comments. If you download the script and have trouble, or if it works perfectly, please leave a comment and let me know.

**Update 12/20/2014** I've just posted step by step instructions for how to use the script..

**Update 11/16/2015** The script has been updated due to a change in how Google Takeout exports the timestamps.

Deploying Installshield package via SCCM fails, Return Code -3

2013-10-24T17:07:00.003-05:00

I recently ran into an issue installing the driver package for some new Interlink "Epad" signature pads we got in at work. The instructions from the readme file for unattended installs matched the typical method for InstallShield packages:

Run the installer with additional parameters to record the install and create a response file. Example: "setup.exe /r /f1c:\temp\setup.iss"
Copy the setup.exe and setup.iss files to the computer where the software needs to be installed.
On the target computer, run "setup.exe /s /f1setup.iss /v/qn"

In theory, this should silently run the installer, using the same responses provided when creating the response file in step 1. In my case, this worked perfectly. As long as I was manually running the command in step3 from an administrative command prompt. When I tried deploying this as an application from system center, using the same command line and the same response file, the installation failed with a return code of "-3".

Since the command works fine when I run it manually, I decided it had to be a problem of the different context in which configmgr was running the installer. Configmgr was running the package as system, not as a user.

When the InstallShield package executes, the first thing it does is extract files into a temporary location. If I run it manually, those files are placed in c:\users\\appdata\local\temp\ - but it can't use the same path when running in the system context. I was able to work around this by adding a "/b" parameter, in which is the directory where I want the setup files extracted to. The final command line used for the application in SCCM looked like this:

"setup.exe" /s /f1setup.iss /bc:\swsetup\ /v/qn

Using that syntax, the application installed successfully from ConfigMgr. Hopefully this information will be useful to others who might run into the same error.

SCCM 2012 OSD Refresh Error: "FAILURE (5456): Unable to determine Destination Disk, Partition, and/or Drive."

2013-07-02T13:35:00.000-05:00

I recently modified our SCCM (MDT Integrated) OSD task sequence so that we could also use the refresh deployment type. One of the requirements for our refresh was that the hard drives be re-partitioned and formatted, just as they would if it were a "New Computer" deployment type. To accomplish this, I copied the "Format Disk" group from the "New Computer Only" section of the task sequence into the "Refresh Only" section.

When testing the refresh deployment, the process started off smoothly, but eventually the task sequence restarted the computer. When the computer tried to boot back up, there was no OS on the drive. The only clue as to the cause was found in the bdd.log file:

FAILURE (5456): Unable to determine Destination Disk, Partition, and/or Drive.

The task sequence attempts to back up the original drive to an image before re-installing the OS. Since I had added the format steps under "Refresh Only" (which is above "Backup" in the task sequence), the drive was already wiped before the backup step tried to run. In my case, I don't want a full backup of the computer anyway, so disabling the backup step resolved the issue. If you do want a full backup before the drive is wiped, moving the "backup" step up into or above the "refresh only" group would probably solve this issue.

Cacheberry Pi

2013-03-18T22:18:00.003-05:00

As an avid Geocacher, when I was thinking of what to do with my Raspberry Pi, I couldn't help but wonder what geocaching related devices I could make. I considered building a geocache that had some kind of electronics, controlled by the Pi, but decided that powering the Pi long term would be an issue. I searched for other ideas online, and came across a video of the Cacheberry Pi project, by Jeff Clement. The perfect mix of geocaching, electronics, and programming, I had found my first project!

The Cacheberry Pi is designed to be used in the car. Place the small box on the dashboard, connect it to power, and while you're driving, the Raspberry Pi will search a pre-loaded database of geocaches for the nearest cache in the direction you're travelling. This is different from most GPS receivers or applications because it searches only a narrow area ahead, and will not return caches that you've already passed by.

I've spent the last few weeks getting it working. I used some slightly different hardware from the original, so it wasn't quite as simple as dropping his image onto my Pi and running it. Here's what I used:

The Cacheberry-Pi displays a dashboard screen when no
nearby caches are found.

Getting the Raspberry Pi up and running was easy. Getting the other hardware working right took a little bit of time. The LCD that I used didn't work with the lcdproc driver included in the original version of the Cacheberry Pi. I struggled for a while to get the lcd working right. For more info on that, and to download the modified driver if you need it, see my previous post on the subject here.

The GPS module I used doesn't connect via USB, but instead connects directly to the GPIO pins on the Raspberry Pi and communicates via serial. By default, the serial port on the Raspberry Pi is set up as a serial console, which must be disabled before it can be used by the GPS. This can be done by making small changes in 2 files.

In /etc/inittab scroll to the end of the document, where you should add a # sign before this line:

T0:23:respawn:/sbin/getty -L ttyAMA0 115200 vt100

Next, edit /boot/cmdline.txt - This file is just one long line of text. Find and remove the following from that line:

console=ttyAMA0,115200 kgdboc=ttyAMA0,115200

GPSD must also be reconfigured for the serial port instead of the USB. To do this, run:

sudo dpkg-reconfigure gpsd

This will start a wizard to configure settings for gpsd. Set gpsd to run automatically at startup, then accept the default settings on each screen until prompted for the port that the gps unit is connected to. Enter the following in the port field:

/dev/ttyAMA0

I've added an extra LED to my cacheberry pi, which is connected directly to the LED pin on the +Adafruit GPS unit. This makes it easy to tell whether the GPS has a signal lock yet. The other LED is controlled by the python code and activates based on the cache search pattern and distance.

I've also forked the Cacheberry Pi project on github and made a few changes to the code. I added some missing steps to the instructions in the readme, to make it easier for others to reproduce the project. I've added configuration settings to display measurements in Metric or Imperial units, localize the time displayed on screen, adjust the scroll speed of geocache data on screen, changed what information about a geocache is displayed on the screen and how it's formatted, and made a few other small changes. I hope these changes can be of help to someone else who is inspired by Mr Clement's project and wants to give it a try.

The updated code with these changes can be found here github.

Still on my to-do list for this project:

Adjust the behavior and triggers for the software controlled LED
Add a push button or keypad to allow simple interaction with the Cacheberry-Pi
Add a method for initiating a safe shutdown of the OS
Add some kind of backup power system which will kick in when the vehicle power is turned off, triggering a safe shutdown of the Pi's OS and powering the Pi long enough for that shutdown to complete.
???

Using a 16x2 LCD with i2c on the Raspberry Pi

2013-02-02T16:11:00.003-06:00

I got a Raspberry Pi for Christmas, and have been playing with it ever since. For one project, I needed to display a couple of lines of text. I ordered a 16 Character x 2 Line LCD display based on an hd44780 compatible controller. From what I had read, I wanted one with an i2c i/o expander. By using i2c, the lcd can be controlled using just 4 GPIO pins from the Raspberry Pi instead of 8. I ended up ordering the SainSmart IIC LCD1602 Display from amazon for just $12.

When I received the LCD, I hooked it up to my Pi and tried using it with a tutorial I found on the raspberry pi blog. The tutorial I was following mentioned that some of the i2c expansion 'backpack' boards connected the i2c chip's pins to the lcd's pins in a different way than others, and that the code has to be modified to use it with other versions. When I couldn't get it working, I looked through the 'documentation' sainsmart offered for download on their website and in the product description on amazon. Unfortunately, the documentation was basically just some sample code for arduino. (As it turns out, the sample arduino code didn't even work. It was written for an old, pre 1.0 version of the arduino IDE.) I contacted sainsmart support to ask for any further documentation available and a schematic of the i2c expander board, but the best they could do is point me to a post on someone's blog about using an i2c controlled lcd with the Raspberry Pi. After examining the path of traces on the backpack board, I was able to map out which pins of the i/o expander chip were connected to which pins of the lcd:


CHIP  LCD

P0       RS

P1       RW

P2       EN

P3       BL

P4       D4

P5       D5

P6       D6

P7       D7

Armed with this information, I was able to get assistance from the lcdproc help to modify the hd44780-i2c driver used by lcdproc. Since I had seen many posts from others with the same problem, I wanted to share the solution. Here is the patch code code that I used to modify the hd44780 driver:

Index: server/drivers/hd44780-i2c.c =================================================================== RCS file: /cvsroot/lcdproc/lcdproc/server/drivers/hd44780-i2c.c,v retrieving revision 1.14 diff -u -r1.14 hd44780-i2c.c --- server/drivers/hd44780-i2c.c 30 Oct 2010 18:04:21 -0000 1.14 +++ server/drivers/hd44780-i2c.c 27 Jan 2013 14:39:31 -0000 @@ -76,10 +85,10 @@ void i2c_HD44780_backlight(PrivateData *p, unsigned char state); void i2c_HD44780_close(PrivateData *p); -#define RS 0x10 -#define RW 0x20 -#define EN 0x40 -#define BL 0x80 +#define RS 0x01 +#define RW 0x02 +#define EN 0x04 +#define BL 0x08 // note that the above bits are all meant for the data port of PCF8574 #define I2C_ADDR_MASK 0x7f @@ -168,43 +214,43 @@ // powerup the lcd now /* We'll now send 0x03 a couple of times, * which is in fact (FUNCSET | IF_8BIT) >> 4 */ - i2c_out(p, 0x03); + i2c_out(p, 0x30); if (p->delayBus) hd44780_functions->uPause(p, 1); - i2c_out(p, enableLines | 0x03); + i2c_out(p, enableLines | 0x30); if (p->delayBus) hd44780_functions->uPause(p, 1); - i2c_out(p, 0x03); + i2c_out(p, 0x30); hd44780_functions->uPause(p, 15000); - i2c_out(p, enableLines | 0x03); + i2c_out(p, enableLines | 0x30); if (p->delayBus) hd44780_functions->uPause(p, 1); - i2c_out(p, 0x03); + i2c_out(p, 0x30); hd44780_functions->uPause(p, 5000); - i2c_out(p, enableLines | 0x03); + i2c_out(p, enableLines | 0x30); if (p->delayBus) hd44780_functions->uPause(p, 1); - i2c_out(p, 0x03); + i2c_out(p, 0x30); hd44780_functions->uPause(p, 100); - i2c_out(p, enableLines | 0x03); + i2c_out(p, enableLines | 0x30); if (p->delayBus) hd44780_functions->uPause(p, 1); - i2c_out(p, 0x03); + i2c_out(p, 0x30); hd44780_functions->uPause(p, 100); // now in 8-bit mode... set 4-bit mode - i2c_out(p, 0x02); + i2c_out(p, 0x20); if (p->delayBus) hd44780_functions->uPause(p, 1); - i2c_out(p, enableLines | 0x02); + i2c_out(p, enableLines | 0x20); if (p->delayBus) hd44780_functions->uPause(p, 1); - i2c_out(p, 0x02); + i2c_out(p, 0x20); hd44780_functions->uPause(p, 100); // Set up two-line, small character (5x8) mode @@ -240,8 +284,8 @@ i2c_HD44780_senddata(PrivateData *p, unsigned char displayID, unsigned char flags, unsigned char ch) { unsigned char enableLines = 0, portControl = 0; - unsigned char h = (ch >> 4) & 0x0f; // high and low nibbles - unsigned char l = ch & 0x0f; + unsigned char h = ch & 0xf0; // high and low nibbles + unsigned char l = (ch << 4) & 0xf0; if (flags == RS_INSTR) portControl = 0; @@ -277,7 +321,7 @@ */ void i2c_HD44780_backlight(PrivateData *p, unsigned char state) { - p->backlight_bit = ((!p->have_backlight||state) ? 0 : BL); + p->backlight_bit = ((p->have_backlight && state) ? BL : 0); i2c_out(p, p->backlight_bit); }

A copy of the modified source code and a compiled, ready to use, copy of the driver file can be downloaded here.

The sainsmart backpack board seems to be a clone of a similar board made by DFROBOT and others, so if your i2c backpack matches the pinouts I listed above, give the modified driver for lcdproc a try.

I hope this post is able to save others from going through the trouble I did to get this LCD working.

Hello World

2013-02-02T11:20:00.003-06:00

Recently, I've found myself wanting to share the occasional information related to my work and hobbies. Thus, a new blog.